PRIVACY STATEMENT
(pursuant to article 13 of Legislative Decree 30/06/2003 No. 196 and subsequent amendments and Article 13 of European Regulation No. 2016/679)
Azienda Agricola B.O., with registered office in Largo Olgiata 15, 00123 Roma, Fiscal Code DNIFNC77R70H501W e VAT number 11708321002, as Data Controller, pursuant to and by effect of Art. 13 Lgs. D. 30.6.2003 n. 196 (hereinafter, “Privacy Code”) and Art. 13 EU Regulation n. 2016/679 (hereinafter, “GDPR”), informs you that your personal data will be processed in full compliance with current legislation on the protection of personal data while using all security measures, both technical and organizational, considered suitable for the protection of the aforementioned data.
1. Data subject to processing
Your data to be processed are the following: name, surname, email address, home address/residence, telephone number.
2. Processing
Your data will be processed by means of the operations covered by Art. 4 of the Privacy Code and Art. 4 n. 2) GDPR, including: collecting, registering, organizing, structuring, preserving, adapting, modifying, extracting, consulting, using, broadcasting, circulating or making available in any form, comparing or interconnecting, limiting, cancelling, destroying.
3. Purpose and legal basis of processing
Your data will be processed for the following purposes:
a. without your express consent (Article 24 of the Privacy Code and Article 6 of the GDPR) – because such processing is required in order to meet an express request from you – for the following purposes:
(i) to answer any requests for information you may make;
(ii) to allow and manage your registration with the site, as well as to enable you to carry out any of the activities you may engage in by virtue of registering with the site.
b. only upon your informed, specific and distinct consent (articles 23 and 130 of the Privacy Code and Arts. 6 and 7 of the GDPR) – since to carry out the processing in question it is necessary to secure your consent – for the following purposes:
(i) send information and promotional communications, including commercial communications, newsletters, advertising material and / or offers of products and services, including personalized offers, and perform statistical and / or market studies and research using both traditional means of contact (mail) and automated ones (email, fax, sms, mms, automated phone calls).
4. Nature of the conferment and consequences of refusal
The conferment of data for the purposes referred to in para. a., point (i), of Art. 3 above, although optional, is necessary in order to meet your requests so that failure to do so makes it impossible for us to provide you with adequate responses.
The conferment of data for the purposes referred to in para. a., point (ii), of article 3 above, although optional, is necessary in order for us to meet your request for registration on the site correctly and therefore failure to do so makes it impossible for you to complete the registration procedure correctly.
The conferment of data and the relative consent to the processing of the same for the purposes referred to in para. b), points (i), (ii) and (iii), of Art. 3 above is optional. However, your refusal and / or providing incorrect and / or incomplete information could prevent the development of profiles, the analysis of your preferences and also prevent the performance of so-called marketing activities, including studies and statistical and / or market research.
If you give your consent, you have the right to revoke it at any time. We remind you that revoking such consent, pursuant to and by effect of Art. 7 of the GDPR, cannot prejudice the lawfulness of the processing of your data based on the consent given before the revocation.
5. Methods of Treatment
The processing of your personal data will be carried out with apposite electronic and / or telematic tools and in ways strictly related to the aforementioned purposes and, in all cases, in such a manner as to guarantee the security and confidentiality of the data.
6. Data retention
The data will be stored at a Data Centre located in Italy and on paper at our offices.
Your personal data and contact details will be used and stored for the purposes set out in Art. 3 above for a period not exceeding 5 (five) years. Data concerning your purchases will be used and stored for the purposes set out in Art. 3) above for a period not exceeding 2 (two) years.
In order to guarantee the data are kept up to date and correct, as well as to update any consent you may have given, Azienda Agricola B.O. will notify you every 12 months as to the methods and contacts – specified in the following articles 11) , 12) and 13) – whereby you can manage your registration.
On expiry of the retention period, the data will be deleted and removed from any paper and / or IT support in a secure manner and in full compliance with legal requirements regarding the protection of personal data; or will be rendered anonymous for the sole purpose of statistical and / or historical analysis, without any of the subjects of the data being identified.
7. Subjects authorized to process data
For the correct execution of the processing referred to in this Note, the following will have access to your data:
employees of Azienda Agricola B.O. specifically appointed as responsible for, and authorized to, undertake the said processing;
b. consultants who provide assistance on legal, tax, accounting and organizational aspects. These consultants operate under specific agreements signed with Azienda Agricola B.O. on the processing of data pursuant to, and for the purposes, of Art. 29 of the Privacy Code and Art. 28 of the GDPR. A list of such third parties is always available in the owner’s office.
8. Communication and dissemination of data
The Data Controller may communicate data in his/her possession to Supervisory Bodies and / or to Judicial Authorities as well as to all other subjects to whom such communication is legally mandatory for the carrying out of their duties. Your data will not otherwise be disseminated and / or disclosed.
9. Data transfer
The management and storage of personal data will be carried out on servers located within the European Union belonging to the Owner and / or to third-party companies duly appointed as External Managers of the processing. In any case it is understood that a subsequent and possible transfer of data outside the European Union would take place in accordance with any legal provisions applicable – including articles 44, 45 and 46 of the GDPR – as well as any suitability decisions adopted by the European Commission and, if necessary, and in the absence of suitability decisions, by stipulating agreements that guarantee an adequate level of protection and / or adopting the standard contractual clauses provided by the European Commission.
10. Rights of interested parties
As an interested party, you are entitled to the rights set forth in Art. 7 of the Privacy Code and articles 13 et seq. of the GDPR.
Specifically, you are entitled to:
pursuant to, and for the purposes of, Art. 7 of the Privacy Code, obtain confirmation regarding the existence or otherwise of personal data concerning you and to have these communicated to you in intelligible form (e.g.: in electronic or paper format);
b. pursuant to, and for the purposes of, Art. 7 of the Privacy Code, to access information on: i) the categories of data in question; ii) the origin of personal data, the purposes and methods of processing and the retention period or, if not possible, of the criteria used to determine the period; iii) the logic applied if processing is carried out with the aid of electronic instruments; iv) details of the identities of the owner, the managers and the designated representative pursuant to Art. 5, paragraph 2 of the Privacy Code and Art. 3, paragraph 1, GDPR; v) the subjects or categories of subjects to whom your personal data may be communicated or who can access them as appointed representatives managers or agents in the country;
c. pursuant to and for the purposes of Art. 7 of the Privacy Code, to obtain: i) updates, corrections or, if necessary, integration of data; ii) cancellation, transformation into anonymous form or blockage of data processed unlawfully, including data whose retention is unnecessary for the purposes for which these data were collected or subsequently processed; ii) written confirmation that the operations referred to in points i) and ii) have been brought to the attention, including with regard to their contents, of those to whom the data were communicated or disseminated, except in the cases where doing so would prove impossible or involve the use of means manifestly disproportionate to the right being protected;
d. pursuant to and for the purposes of Art. 7 of the Privacy Code, to object in whole or in part: i) for legitimate reasons, to the processing of personal data concerning you, even if relevant to the purpose of collection; ii) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications, through operator-less automated call systems, by email and / or through traditional marketing methods, by telephone and / or mail. It should be noted that the interested party’s right of opposition, set out in point ii), for direct marketing purposes through automated methods, extends to traditional media and that at any event the interested party is entitled to exercise his or her right of opposition only partially. Interested parties may therefore decide to receive only communications using traditional methods or only automated communications or neither;
e. pursuant to and for the purposes of Art. 13 of the GDPR, to make a complaint to a competent authority;
f. pursuant to and for the purposes of Art. 15 of the GDPR, to access information related to the processing of data, including: the purposes of the processing; the types of personal data processed; how long the personal data are expected to be stored or, if not available, the criteria used to determine that period; the recipients or categories to whom the data were or will be communicated; any transfer of data to third countries; if the data were not collected from the interested party, any available information as to their origin; the existence of an automated decision-making process, the logic applied to the segmentation of users for profiling activities and the importance of such processing for the data subject;
g. pursuant to and for the purposes of Art. 16 of the GDPR, to obtain the correction of inaccurate data and the integration of incomplete data;
h. pursuant to and for the purposes of Art. 17 of the GDPR, the right to request cancellation and obtain it on grounds including: the data are not necessary in respect of the purposes for which they were collected; personal data was unlawfully processed; personal data must be deleted as a consequence of a legal obligation established by the law of the European Union or the Member States and which applies to the Data Controller; the interested party has revoked the consent. This right cannot be exercised if the data are necessary for the management of complaints.
i) pursuant to and for the purposes of Art. 18 of the GDPR, to obtain the limitation of processing under certain circumstances, including: the personal data available to Azienda Agricola B.O. are inaccurate; the interested party does not agree with the use of his or her data but opposes their cancellation and therefore requires a limitation of their use; Azienda Agricola B.O. does not need to keep the data but the interested party needs them for possible complaints. In the case of a request for limitation, the data will be processed only so as to conserve them and for certain other reasons including: complaints by the interested party; expressions of consent by the interested party; protection of the rights of other physical or legal persons, or for reasons of public interest at the level of the European Union or of a particular Member State.
j. pursuant to and for the purposes of Art. 20 of the GDPR, the right to receive their data in a structured, simple and legible form and to transmit them to another Data Controller in the cases provided for by the aforementioned law.
11. Data Controller
The Data Controller is Azienda Agricola B.O., resident in Largo Olgiata 15, 00123 Roma , Fiscal Code DNIFNC77R70H501W and VAT number 11708321002.
12. How to exercise the above rights
To exercise the rights referred to in Art. 11), you may write to the Data Controller at the following addresses: Azienda Agricola B.O. Via Vallelunga le Rote 5, 00060 Mazzano Romano info@spasuitebo.com
13. Changes to this statement
This information note on data processing may change. It is therefore advisable to check this note regularly and refer to the latest version. Should you not accept the changes made, you can at any time cancel your registration with the Site or modify and / or revoke your previously expressed consent through the contacts mentioned above.